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Toward  a  Fail-Safe  Air  Force  Culture: 

Creating  a  Resilient  Future  While  Avoiding  Past  Mistakes 

Lt  Col  Todd  C.  Ericson,  USAF 

Col  Steve  Goldfein,  commander  of  the  1st  Fighter  Wing,  summed 
up  his  responsibility  stating,  “In  the  end,  commanders  do  only  two 
things — provide  vision  and  set  the  environment.  Almost  everything  you 
do  for  the  organization  falls  into  one  of  these  categories.”1  Unfortunately, 
it  is  often  in  the  wake  of  incidents,  tragedies,  or  failures  that 
shortcomings  are  exposed. 

Gen  Ronald  R.  Fogleman,  former  Air  Force  chief  of  staff,  inherited  a 
series  of  such  incidents  when  he  took  command.  In  response,  he  issued 
an  August  1995  video  tape  on  the  topic  of  “Air  Force  Standards  and 
Accountability.”  The  tape  followed  additional  administrative  actions  he 
directed  against  officers  involved  in  the  14  April  1994  shootdown  of  two 
US  Army  helicopters.2  In  the  immediate  aftermath  of  this  incident  only 
one  officer,  the  airborne  warning  and  control  system  (AWACS) 
commander  Capt  Jim  Wang,  was  court-martialed  for  the  death  of  26 
friendly  personnel.3  Others  involved,  to  include  the  F-15  pilots  who 
actually  shot  down  the  helicopters,  received  nonjudicial  punishments 
which  were  initially  intended  to  remain  outside  of  their  permanent 
service  records.  In  defending  the  additional  punishments  he  levied, 
Fogleman  argued  the  lack  of  initial  accountability  was  an  unacceptable 
failure  of  leadership.4  Significantly,  this  all  transpired  only  a  few  months 
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after  Col  William  E.  Pellerin’s  court-martial  in  the  notorious  24  June 
1994  crash  of  a  B-52  at  Fairchild  AFB,  Washington — a  crash  resulting 
from  the  actions  of  a  rogue  subordinate  pilot,  Lt  Col  Arthur  Holland,  and 
the  lack  of  accountability  exhibited  by  his  senior  officers.5 

The  inadvertent  transportation  of  nuclear  cruise  missile  warheads 
on  a  B-52  from  Minot  AFB,  North  Dakota  and  the  shipping  of  nonnuclear 
intercontinental  ballistic  missile  components  to  Taiwan  are  analogous 
contemporary  events.  Dr.  James  R.  Schlesinger’s  2008  report  to  the 
secretary  of  defense  documented  atrophy  in  the  Air  Force’s  nuclear 
enterprise  as  a  primary  cause  for  these  failures.  The  report  highlighted  “a 
serious  erosion  of  focus,  expertise,  mission  readiness,  resources,  and 
discipline  in  the  nuclear  weapons  enterprise  within  the  Air  Force.”6 
Secretary  of  the  Air  Force  Michael  Wynne  and  Air  Force  Chief  of  Staff 
Gen  T.  Michael  Moseley  both  resigned  in  the  wake  of  these  incidents,  and 
on  24  October  2008  the  new  secretary  of  the  Air  Force,  Michael  Donley, 
and  Air  Force  Chief  of  Staff  Gen  Norton  Schwartz  issued  their  “Strategic 
Plan  to  Reinvigorate  the  Air  Force  Nuclear  Enterprise.”7  Notably,  the 
strategic  plan  identified  the  establishment  of  a  “zero-defect”  culture  as  a 
primary  attribute  for  a  successful  Air  Force  nuclear  enterprise,  stating 
“there  is  no  tolerance  for  complacency  or  shortcuts  as  we  rebuild  a  ‘zero- 
defect’  culture.”8 

Each  of  these  incidents  represents  a  catastrophic  institutional 
failure — failures  which  must  be  prevented.  Ceding  the  impossibility  of 
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omnipresence,  Colonel  Goldfein  correctly  observes  that  choice  of  vision 
and  cultural  development  are  leadership’s  fundamental  tools  in  building 
a  successful  organization.  The  cultural  options  available  to  espouse  span 
a  continuum  from  a  ruthless  zero-defects  method  to  a  gentler  tolerance- 
based  style.  While  a  zero-defect  approach  can  garner  short-term  success, 
the  ensuing  culture  of  fear  and  reprisal  are  not  conducive  to  sustained 
excellence.  Conversely,  a  tolerant  approach  may  achieve  short-term 
morale  benefits,  but  the  resulting  lack  of  discipline  arising  out  of  a 
culture  of  ambivalence  dampens  long-term  productivity.  Ultimately,  long¬ 
term  high  performance  is  possible  through  a  fail-safe  culture  which 
paradoxically  embraces  failure  in  building  a  resilient  enterprise.  Modern 
research  on  high  reliability  organizations  (HRO),  coupled  with 
contemporary  leadership  theory,  provide  a  framework  to  expose  the 
shortcomings  of  both  the  zero-defect  and  tolerance-based  approaches, 
assess  current  culture,  and  then  define  the  cultural  characteristics 
required  to  implement  a  mindful  approach  to  ensuring  the  Air  Force  can 
achieve  its  mission  by  maximizing  our  ability  to  “fly,  fight,  and  win  ...  in 
air,  space,  and  cyberspace.”9 

Tolerance-Based  Culture 

A  tolerance-based  culture  fundamentally  embraces  a  Kantian  belief 
in  the  inherent  goodness  of  man  and  concludes  that  with  proper 
guidance  people  will  “do  the  right  thing.”  In  this  culture,  empowerment  of 
individuals  and  their  ability  to  improve  the  system  is  primal  while 
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discipline  and  external  accountability  are  relegated  to  lesser  roles.  Its 
ideal  is  the  attainment  of  a  self-policing  workforce — one  that  corrects 
problems  before  they  have  the  opportunity  to  amplify.  The  Air  Force 
embraced  such  a  system  in  the  late  1980’s  through  the  mid  1990’s, 
under  the  Quality  Air  Force  (QAF)  banner.  QAF  borrowed  heavily  from 
the  Total  Quality  Management  (TQM)  work  of  Dr.  W.  E.  Deming  and 
asserted  that  TQM’s  successful  transformation  of  business  practices 
could  also  transform  the  Air  Force.  Air  Force  Systems  Command’s  1989 
implementation  brief  defined  the  QAF  ideal  as:  “A  leadership  philosophy, 
organizational  structure  and  working  environment  that  fosters  and 
nourishes  a  personal  accountability  and  responsibility  for  quality  and  a 
quest  for  continuous  improvement  in  products,  services  and 
processes.”10 

The  proposal  was  seductive  as  Deming’s  plan,  do,  check,  act 
(PDCA)  cycle  that  transformed  post-WWII  Japanese  industry  paralleled 
Col  John  Boyd’s  famous  observe,  orient,  decide,  act  (OODA)  loop  for 
military  operations.  Deeper  analysis,  however,  reveals  a  fundamental 
difference.  The  subtle  replacement  of  “decide”  with  “check”  initiated  a 
cultural  shift  away  from  leadership  decisions  to  one  where  measurement 
of  processes  and  metrics  informed  the  proper  course  of  action. 

QAF  transformed  Air  Force  regulations  into  softer  instructions  and 
replaced  harsh  inspections  with  gentler  quality  Air  Force  assessments 
(QAFA).  Graham  Rinehart  summarized  the  impact  to  the  force  as  “Airmen 
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saw  TQM  as  an  abdication  of  leadership,  especially  when  it  combined 
with  empowerment — another  fine  concept  that  became  badly  mangled 
and  unrecognizable  in  the  end.”11  The  sentiment  was  echoed  by  Gen 
John  Jumper  in  a  2001  speech  to  the  Senior  NCO  [noncommissioned 
officer]  Academy  three  months  prior  to  his  selection  as  Air  Force  chief  of 
staff.  He  bluntly  stated,  “But  we  went  through  a  period  in  the  decade  of 
the  ’90s  where  the  Air  Force  lost  some  of  its  character  as  an  institution. 
We  once  had  a  quality  Air  Force  that  was  ruined  by  a  concept  known  as 
Quality  Air  Force.”12  General  Jumper  continued,  advocating  that 
“‘quality’  was  used  as  a  substitute  for  leadership.  It  let  words  and 
slogans  guide  our  behavior.  Words  like  'empowerment,'  'break  down 
barriers.'  We  stopped  mentoring  our  people.  We  lost  touch  with  the  fine 
art  of  chewing  ass.  An  example  of  this  is  the  Blackhawk  shootdown.  We 
screwed  up  with  those  F-15  pilots.  The  essential  nature  of  our  business 
is  to  gain  and  maintain  air  superiority  by  shooting  down  bad  guys.  When 
you  visually  ID  [identify]  an  aircraft  and  shoot  it  down,  and  it's  one  of 
ours,  you  have  failed  in  your  primary  mission.  It's  worse  than  a  doctor 
taking  out  the  wrong  lung.  Something  should  have  been  done.”13  Justice 
had  not  been  served. 

Similarly,  the  Air  Force  also  acknowledged  its  mistake  in 
transforming  regulations.  The  subsequent  addition  of  the  phrase, 
“COMPLIANCE  WITH  THIS  PUBLICATION  IS  MANDATORY,”  on  the  cover 
of  each  Air  Force  instruction  was  designed  to  ensure  personnel 
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understood  implementation  was  not  optional.  By  the  mid  1990s,  QAF 
had  fallen  out  of  vogue,  never  obtaining  the  sweeping  cultural  change 
envisioned.  Its  legacy,  however,  survives  in  both  the  officer  performance 
reporting  (OPR)  system14  and  under  the  auspices  of  the  Air  Force  smart 
operations  for  the  21st  century  (AFS021)  program. 

AFS02 1  strives  to  eliminate  many  of  QAF’s  deficiencies  while 
simultaneously  reinforcing  its  strengths.  According  to  Air  Force  Material 
Command  instruction  (AFMCI)  90-104,  Implementing  AFSO 2 1  Initiatives, 
“AFS021  represents  an  Air  Force  model  for  continuous  process 
improvement  (CPI)  that  uses  various  methodologies  depending  on  the 
needs  of  the  situation  or  problem  under  review.”15  The  program  has  two 
stated  goals:  1)  “To  fundamentally  change  the  culture  of  the  Air  Force 
(AF)  so  that  all  Airmen  understand  their  individual  role  in  improving 
their  daily  processes  and  eliminating  wasted  efforts  that  add  no  value  to 
mission  accomplishment;”16  and  2)  “To  instill  a  mindset  of  continuous 
process  improvement  and  problem  solving  across  the  USAF  workforce.”17 
Compliance  with  this  AFMCI  is  mandatory. 

Zero-Defects  Culture 

Contrast  this  cultural  shift  toward  the  middle  following  QAF  with 
the  nuclear  enterprise’s  renewed  focus  on  a  zero-defects  culture.  The  Air 
Force’s  history  with  Strategic  Air  Command  (SAC)  serves  as  an  effective 
model  for  the  implications  of  this  policy.  Despite  corporate  memories 
growing  fonder  over  time,  under  Gen  Curtiss  LeMay  SAC  embodied  a 
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ruthless  culture  of  discipline.  Folklore  recounts  the  standard  response  to 
a  failing  inspection  was  General  LeMay  immediately  flying  to  the 
unfortunate  base  with  a  replacement  wing  commander  prior  to  the 
outbrief.  Regardless  of  tale’s  truth,  its  existence  is  illustrative  of  SAC’s 
culture.  A  security  forces  Airman  assigned  to  SAC  in  the  late  1980’s 
stated  during  an  interview  that  his  primary  job  (and  that  of  his 
supervisor’s)  was  to  pass  inspections  at  all  costs — outcome  focus  in 
response  to  ruthless  discipline  following  past  failures.18  Unfortunately, 
the  long-term  impact  of  this  approach  pressured  honorable  men  to 
sacrifice  their  integrity  in  support  of  a  zero-defects  fapade.  Compelling 
testament  is  that  the  Airman,  today  a  lieutenant  colonel,  remains  too 
shamed  by  his  actions  to  allow  citing  of  specific  details  or  his  name.19 

Objectively,  how  did  SAC  really  compare  to  today’s  denigrated 
nuclear  culture?  According  to  the  Department  of  Defense’s  Narrative 
Summaries  of  Accidents  Involving  U.S.  Nuclear  Weapons:  1950-1980,  32 
accidents  involving  nuclear  weapons  occurred  during  this  time  period 
resulting  in  the  loss  of  at  least  42  nuclear  weapons  or  portions  thereof.20 
Most  alarming  is  that  six  weapons  were  never  recovered  and  that  only 
four  of  these  accidents  (less  than  10  percent)  did  not  involve  US  Air  Force 
aircraft,  missiles,  or  assets.21  One  of  the  most  egregious  of  these 
accidents  occurred  on  22  May  1957  when  a  B-36  crew  unintentionally 
dropped  a  nuclear  weapon  while  on  approach  to  Kirtland  AFB,  New 
Mexico.  The  weapon’s  high  explosives  detonated  upon  impact,  leaving 
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only  a  single  safety  procedure  to  prevent  nuclear  detonation.22  While  the 
lack  of  comparison  data  make  it  impossible  to  conclude  what  role  a  zero- 
defects  culture  played  in  these  accidents,  the  data  aptly  demonstrate  the 
inability  of  SAC’s  zero-defects  culture  to  prevent  such  accidents. 
Fortunately,  comparative  studies  from  the  business  world  provide  such 
data-driven  analysis  of  cultural  impacts  on  long-term  organizational 
performance. 

Jim  Collins’  recent  survey  of  companies  in  the  book  Good  to  Great 
is  one  such  study.  His  team  found  a  very  strong  correlation  between 
those  corporations  which  significantly  outperformed  their  competitors  in 
the  long-term  and  a  “culture  of  discipline.”  He  observed  of  the  high- 
performing  entities  “.  .  .  they’re  not  ruthless  cultures,  they’re  rigorous 
cultures.  And  the  distinction  is  crucial.  To  be  ruthless  means  hacking 
and  cutting,  especially  in  difficult  times,  or  wanton  firing  people  without 
any  thoughtful  consideration.  To  be  rigorous,  not  ruthless,  means  that 
the  best  people  need  not  worry  about  their  positions  and  can  concentrate 
fully  on  their  work.”23  Conversely,  he  also  discovered  “.  .  .a  pattern  we 
found  in  every  unsustained  comparison:  a  spectacular  rise  under  a 
tyrannical  disciplinarian,  followed  by  an  equally  spectacular  decline 
when  the  disciplinarian  stepped  away,  leaving  behind  no  enduring 
culture  of  discipline,  or  when  the  disciplinarian  himself  became 
undisciplined  and  strayed  .  .  .”24  In  other  words,  tyrannical  discipline 
under  a  zero-defects  philosophy  produces  short-term  results. 
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US  Defense  Secretary  William  Perry  recognized  this  in  1996  when 
he  criticized  a  zero-defects  culture  by  remarking  that  “demanding  such  a 
rigid  standard  produces  timid  leaders  afraid  to  make  tough  decisions  in 
crisis,  unwilling  to  take  the  risks  necessary  for  success  in  military 
operations.  This  zero-defects  mindset  creates  conditions  that  will  lead 
inevitably  to  failure.”25  Weick  and  Sutcliff,  authors  of  the  book  Managing 
the  Unexpected,  agree.  They  researched  companies  in  fields  similar  to  the 
nuclear  enterprise  and  the  Air  Force  in  general — companies  where  the 
cost  of  failure  is  severe  and  where  consistent,  long-term,  highly-reliable 
operations  are  essential.  Despite  these  consequences,  Karl  Weick  and 
Kathleen  Sutcliff  found  that  HRO’s  embraced  rather  than  suppressed 
failures.  They  observed  “HROs  encourage  reporting  of  errors,  they 
elaborate  experiences  of  a  near  miss  for  what  can  be  learned,  and  they 
are  wary  of  the  potential  liabilities  of  success,  including  complacency,  the 
temptation  to  reduce  margins  of  safety,  and  the  drift  into  automatic 
processing.”26  Instead  of  perpetuating  the  mindset  that  failure  cannot 
occur,  HROs  not  only  accept  that  failures  will  occur  but  also  structure 
themselves  to  prevent  these  failures  from  becoming  catastrophic. 

The  long-term,  sustained  excellence  demanded  by  the  nuclear 
enterprise  and  the  Air  Force  in  general  requires  a  shift  to  a  new  fail-safe 
approach  that  instills  a  culture  of  rigorous,  not  ruthless,  discipline.  This 
is  a  culture  that  recognizes  the  strengths  and  shortcomings  resident  in 
both  zero-defects  and  tolerance-based  approaches.  Ironically,  its 
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template  already  exists  and  even  thrives  inside  well-established  Air  Force 
organizations  today. 

Fail-Safe  Culture 

The  concept  of  a  fail-safe  culture  is  straightforward.  It  begins  with 
simply  defining  that  which  ultimately  must  be  prevented.  As  with  an 
aircraft,  the  designer’s  ultimate  goal  is  to  ensure  that  his  plane  is 
capable  of  accomplishing  its  mission  without  loss  of  life  or  equipment. 
Analogous  to  an  organization,  mission  constraints  define  the  physical 
characteristics  of  the  aircraft.  Fighters  differ  from  transports  as  the 
former  require  speed  and  maneuverability  while  the  latter  values  range 
and  payload.  From  a  global  perspective,  the  designer’s  task  is  to  create  a 
system  of  complex  mechanical  and  electronic  systems  which  must 
operate  in  concert.  Conceding  that  failure  of  components  in  each  of  these 
systems  is  inevitable  during  the  aircraft’s  service  life,  the  designer  must 
ensure  that  such  a  failure  won’t  result  in  a  catastrophic  crash.  The 
resulting  aircraft  must  be  resilient,  not  perfect.  And  although  all  types 
are  designed  from  within  the  same  set  of  physical  boundaries,  mission 
requirements  dictate  that  one  size  does  not  fit  all. 

Design  resiliency  is  achieved  by  two  means,  the  first  proactive  and 
the  second  reactive.  The  first  seeks  to  improve  the  reliability  of  individual 
components  and  thus  minimize  the  probability  a  failure  ever  occurs. 
Unfortunately,  100  percent  reliability  is  not  possible  in  parts  conceived, 
designed,  built,  maintained,  and  operated  by  humans.  Therefore, 
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components  are  either  inspected  or  replaced  well  prior  to  predicted 
failure,  operational  limitations  are  imposed,  or  procedural  prohibitions 
are  established.  Secondly,  reactive  measures  in  the  form  of  backups  and 
redundancies  are  designed  into  a  system  on  the  assumption  that  the 
proactive  measures  are  either  insufficient  or  not  all-encompassing.  These 
measures  are  the  designer’s  hedge  against  the  unknown.  Thus  both 
proactive  and  reactive  methodologies  work  as  an  effective  offense  and 
defense  against  the  ultimate  catastrophic  event.  Aerospace  engineers 
tout  this  as  a  fail-safe  design  approach. 

Importantly,  the  fail-safe  process  does  not  stop  at  the  initial 
design.  Once  in  service,  data  from  actual  component  failures,  inspection 
results,  and  accident  reports  are  fed  back  into  the  system.  This  data  are 
incorporated  as  improvements  in  subsequent  models,  modifications  to 
existing  aircraft,  or  as  changes  to  operations  and  maintenance  manuals. 
A  parallel  process  focuses  on  the  operators  and  the  two  merge  in  our 
safety  organizations.  The  Air  Force  safety  system,  guided  by  the  precept 
of  privilege  or  nonattribution,  effectively  reduced  noncombat  Class  A 
accident  rates  (per  100,000  flying  hours)  from  44.22  in  1947  to  only  0.80 
in  2009. 27  While  impressive,  the  62  years  of  data  also  demonstrate  the 
Air  Force’s  inability  to  achieve  a  zero-defect  flying  program. 

In  a  fail-safe  framework  tolerance  to  each  failure  is  defined  by 
mission  differences.  An  F-16,  for  example,  was  generally  designed  with 
sufficient  backups  to  only  allow  it  to  safely  return  to  base  after  a 
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failure — a  conscious  trade  of  mission  capability  rates  for  mission 
performance.  A  C-17’s  mission,  by  comparison,  demands  backups  that 
allow  full  mission  capability  in  the  event  of  a  single  failure.  Likewise,  the 
lack  of  a  pilot  alternatively  increases  an  remotely  piloted  aircraft 
designer’s  tolerance  to  failure  (including  crashes)  as  evidenced  by  lifetime 
Class  A  mishap  rates  (per  100,000  flying  hours)  over  three  times  greater 
than  equivalent  manned  aircraft — 10.05  versus  2.89. 28  While  all  of  these 
designs  are  fail-safe,  their  missions  dictate  different  measures  of  merit  in 
determining  the  appropriate  design  tradeoffs.  The  same  is  true  of  Air 
Force  conventional,  nuclear,  space,  and  cyberspace  missions. 

Building  a  “Fail-Safe”  Culture 

How  does  this  apply  to  the  Air  Force?  First  it  is  essential  to  define 
what  must  not  be  allowed  to  occur — catastrophic  failures.  At  the  Air 
Force  level  catastrophic  failures  represent  anything  which  threatens  the 
mission  to  “fly,  fight  and  win  ...  in  air,  space,  and  cyberspace”  or  its 
vision  of  “Global  Vigilance,  Reach,  and  Power.”  Catastrophic  cultural 
failure  occurs  when  the  Air  Force’s  core  values  of  “Integrity  first,  Service 
before  self,  and  Excellence  in  all  we  do”  are  compromised.  Similarly,  as  a 
designer  prioritizes  aircraft  traits  based  on  mission,  each  command  must 
define  additional  catastrophic  failures  based  on  its  unique 
circumstances.  For  example,  a  top-level  list  for  Global  Strike  Command 
(GSC)  must  include  avoiding  an  accidental  detonation  of  a  nuclear 
device;  Air  Force  Space  Command  must  prevent  total  disruption  of 
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satellite  communications  and  navigation  services;  Cyber  Command  must 
prevent  an  enemy  from  crippling  our  networks.  A  fail-safe  approach 
asserts  that  while  failure  at  lower  levels  is  undesirable,  these  lesser 
failures  must  be  embraced  instead  of  feared  since  they  are  the  greatest 
source  of  information  about  how  to  ultimately  prevent  the  catastrophic 
failures.  Potential  failures  are  next  ranked  from  most  to  least 
catastrophic  with  responsibility  for  each  of  the  areas  being  placed 
squarely  on  the  shoulders  of  a  specific  individual  with  commensurate 
authority.  If  responsibility  and  authority  are  diffused,  it  is  not  possible  to 
justly  hold  people  accountable  for  either  preventing  catastrophic  failures 
or  in  the  event  they  occur. 

The  Air  Force  safety  process  often  uses  the  “Swiss  cheese”  model  to 
evaluate  accidents.  The  image  of  holes  in  the  protective  cheese  layers 
(proactive  and  reactive  measures)  lining  up  in  such  a  way  as  to  allow  an 
accident  is  extremely  instructive.  Conceptually,  these  protective  layers 
represent  expectations.29  Continuing  the  aircraft  design  analogy,  an 
expectation  that  fly-by-wire  controls  will  prevent  an  aircraft  stall  relies  on 
an  expectation  the  angle  of  attack  system  will  provide  the  correct 
information.  When  either  expectation  doesn’t  hold  true,  it  is  normally 
due  to  another  failed  expectation,  such  as  the  failure  of  a  sensor.  This  is 
not  to  say  that  HROs  aren’t  concerned  about  each  of  the  individual 
failures.  They  are,  and  certainly  strive  to  minimize  the  number  and  size 
of  holes  in  each  slice  of  cheese.  More  importantly,  however,  a  HRO’s 
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focus  is  on  “the  process  of  the  slices  lining  up  as  each  moment  where  one 
hole  aligns  with  another  represents  a  failed  expectation.  And  each  failed 
expectation  is  also  an  opportunity  to  stop  the  progression  toward  a 
brutal  audit.”30 

Generally,  it  is  both  daily  operations  and  the  inspection  process 
which  provide  ongoing  insight  into  the  process  of  the  holes  lining  up. 
Failures  represent  the  opportunity  for  an  in-depth  analysis,  but  only  if 
an  organization  embraces  them  and  values  a  thorough  and  critically 
honest  root-cause  investigation.  The  logical  conclusion  of  a  zero-defect 
culture  is  that  any  failure  during  operations  or  an  inspection,  no  matter 
how  small,  is  unacceptable.  Acceptance  of  this  vision  within  GSC  is 
evidenced  by  the  recent  firings  of  nuclear  enterprise  leadership  at  a  rate 
far  in  excess  of  their  conventional  Air  Force  counterparts.31  Conversely,  a 
tolerance-based  culture’s  lack  of  just  accountability  downplays  the 
seriousness  of  failures  and  often  discards  valuable  lessons. 

Behavioral  research  across  various  fields  supports  the  axiom  that 
“perceptions  are  reality.”32  Dr.  Jack  Kasulis  and  Dr.  Robert  Lush 
conclude  from  their  study  of  business-customer  relations  that  “in  other 
words,  perceptions  are  reality  for  the  consumer  regardless  of  objective 
reality.”33  Maria  Sillanpaa  concludes  from  her  research  on  effective,  long¬ 
term  corporate  strategies  that  “for  effective  stakeholder  inclusion, 
perceptions  are  reality.  A  misunderstanding  is  no  less  damaging  to  a 
relationship  regardless  of  whether  the  company  or  the  stakeholder  is  to 
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blame.”34  In  forming  the  desired  culture  we  must  therefore  be  cognizant 
of  the  perception  portrayed  by  actions  and  work  to  align  those 
perceptions  with  reality.  As  leaders,  these  perceptions  are  initially  set  by 
our  words  and  are  ultimately  confirmed  or  denied  by  our  actions.  These 
actions  fall  into  one  of  two  broad  categories:  rewards  and  punishment. 

Rewards  and  Punishment  in  a  Fail-Safe  Culture 

Experience  bears  out  the  timeless  axiom,  “You’ll  catch  more  flies 
with  honey  than  vinegar.”  Positive  rewards  induce  the  desired  behavior 
while  punishment  deters  undesirable  actions  by  setting  boundaries  on 
acceptable  behavior.  Recall  that  Collins  found  a  very  strong  correlation 
between  those  companies  which  significantly  outperformed  their 
competitors  and  a  rigorous  “culture  of  discipline.”35  Instilling  such  a 
culture  of  rigorous,  not  ruthless,  discipline  is  at  the  heart  of  a  fail-safe 
organization. 

How?  After  defining  the  enterprises’  catastrophic  failures,  the  next 
step  is  a  continual  assessment  of  the  organization’s  proactive  and 
reactive  design  in  support  of  these  objectives.  This  is  not  a  complete 
overhaul  of  existing  procedures,  regulations,  or  hardware,  but  is 
conversely  a  mindful  analysis  of  the  existing  design  with  an  eye  toward 
evolutionary  improvements.  The  essential  input  to  this  feedback  process 
is  information.  And  that  information  is  inexorably  linked  to  the 
organization’s  culture  through  its  people. 
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Weick  and  Sutcliffe  observed  HROs  exhibit  what  they  term  a 
“Learning  Culture,”  one  that  adapts  to  changing  demands  and  ensures 
that  people  feel  free  and  willing  to  discuss  errors.  This  culture  also 
represents  “‘an  atmosphere  of  trust  in  which  people  are  encouraged,  even 
rewarded,  for  providing  essential  safety-related  information — but  in 
which  they  are  clear  about  where  the  line  must  be  drawn  between 
acceptable  and  unacceptable  behavior.  ’  That  line  is  critical  because  it 
separates  unacceptable  behavior  that  deserves  disciplinary  action  from 
acceptable  behavior  for  which  punishment  is  not  appropriate  and  the 
potential  for  learning  is  considerable.”36  Similarly,  Prof.  Marc  de  Laval 
describes  this  desired  culture  as  “an  abandonment  of  the  easy  language 
of  blame  in  favour  of  a  commitment  to  understand  and  learn.  It  calls  for 
significant  leadership.”37  Although  detailing  how  the  Air  Force  cultivates 
these  characteristics  in  a  fail-safe  culture  is  beyond  the  scope  of  this 
article,  it  already  possesses  at  least  three  organizational  benchmarks  as 
templates:  the  flight  safety  process,  the  flight  test  community’s  test  safety 
methodology,  and  the  fighter  community’s  brief/ fly/ debrief  cycle.  All 
exhibit  high  standards  of  discipline  but  also  are  extremely  rigorous  in 
learning  from  small  mistakes  as  a  means  to  prevent  future  catastrophes. 

Exemplifying  this  rigor,  the  4 1 6th  Flight  Test  Squadron  selected  a 
team  that  highlighted  a  potential  problem  as  the  1st  Quarter  2010  test 
team  of  the  quarter.  They  were  selected  not  because  they  met  an 
efficiency  standard  measured  by  the  normal  metrics  of  cost,  schedule,  or 
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performance  as  their  actions  both  increased  cost  and  further  delayed  a 
critical  program  already  behind  schedule.  Why  was  such  behavior 
appreciated?  Because,  despite  cost  and  schedule  pressures,  they  had  the 
courage  to  make  the  right  choice  and  the  long-term  positive  impact  on 
unit  culture  far  outweighed  the  short-term  losses.  The  award  was  a 
tangible  demonstration  of  the  unit’s  emphasis  on  safety,  proving  that 
leadership  embraced  their  rhetoric — actions  speaking  far  louder  than 
words. 

Conversely,  discipline  serves  the  essential  purpose  of  setting 
boundaries  on  actions  in  a  manner  analogous  to  how  our  pain  response 
to  a  hot  pan  both  minimizes  the  short-term  burn  and  teaches  us  to  avoid 
subsequent  ones.  Pain  is  therefore  an  essential  tool  our  body  uses  to 
prevent  a  bad  situation  from  becoming  dire.  Likewise,  punishment  and 
consequences  for  actions  are  essential  tools  in  defining  acceptable  limits 
of  behavior  inside  an  organization.  Col  William  E.  Pellerin  was  court- 
martialed  in  the  Fairchild  B-52  crash  because  he,  and  others  in 
leadership  roles,  failed  to  properly  discipline  Colonel  Holland.  Although 
Colonel  Holland  blatantly  violated  Air  Force  standards  on  multiple 
occasions  prior  to  24  June  1994,  his  leadership  chose  to  ignore  these 
“lesser”  breaches  of  standards.  Unfortunately,  they  and  three  other  dead 
crewmembers  of  Czar  87  couldn’t  ignore  the  catastrophic  failure  their 
lack  of  discipline  enabled. 
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Beyond  failure  avoidance,  implementation  of  consistent  and  fair 
discipline  inside  of  well-established  boundaries  also  bears  the  positive 
byproduct  of  instituting  a  sense  of  comfort  and  security  within  an 
organization.  In  a  just  organization,  people  have  no  fear  of  doing  right 
and  are  comforted  in  the  knowledge  that  doing  the  wrong  will  not  be 
tolerated.  They  understand  their  boundaries. 

Justice  in  a  Fail-Safe  Culture 

Col  Dave  Goldfein,  in  his  book  Sharing  Success,  Owning  Failure, 
asserts  it  is  the  commander’s  responsibility  to  provide  justice  in 
discipline.  When  accomplished  properly,  he  stresses,  “Military  discipline, 
handled  with  fairness,  timeliness  and  compassion  is  always  positive.”38 
Our  role  as  leaders  is  analogous  to  that  of  a  parent  as  we  strive  to 
reinforce  positive  behaviors  and  work  to  effectively  correct  negative 
behaviors.  World  renowned  parenting  authors  Gary  and  Anne  Marie 
Ezzo,39  amplify  Colonel  Goldfein ’s  perspective  stating,  “The 
punishment/ consequences  must  fit  the  crime.  Punishment  sets  a  value 
on  behavior.  That  is  why  over-punishing  or  under-punishing  is 
dangerous;  both  send  the  wrong  message.”40 

In  the  Blackhawk  shoot  down,  it  is  precisely  a  lack  of  justice  which 
led  to  General  Fogleman’s  and  General  Jumper’s  conclusions.  The  initial 
minimal  punishment  received  by  the  F-15  pilots  for  wrongly  identifying 
and  then  killing  26  innocent  personnel  set  an  extremely  low  value  on 
their  negligence.  By  reaffirming  the  standards  and  levying  a  just 
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punishment  for  their  actions,  General  Fogleman  both  recalibrated  Air 
Force  boundaries  on  expected  performance  and  set  an  appropriate  value 
on  such  an  action.  Consider  the  recent  message  sent  by  GSC  leadership 
when  three  missile  crewmembers  were  discharged  from  the  Air  Force 
after  self-reporting  they  inadvertently  slept  while  in  possession  of 
outdated  classified  codes  inside  a  secure  facility.41  Is  it  reasonable  to 
expect  others  will  self-report  future  problems? 

Institutional  justice  is  built  upon  a  foundation  of  integrity,  both 
personal  and  institutional.  Maj  Gen  Perry  M.  Smith  dedicates  an  entire 
chapter  of  his  book  Rules  and  Tools  for  Leaders  to  the  subject.  He  insists 
that  the  first  task  a  leader  must  accomplish  upon  taking  over  is  vital — 
ensure  that  the  organization’s  standards  of  integrity  are  clearly  stated 
and  articulated.42  Once  communicated,  it  is  then  essential  for  the  leader 
to  demonstrate  justice  through  actions.  Justice  is  clear  and  easy  to 
accomplish  when  the  problem  is  black  and  white.  Unfortunately,  most 
real-world  situations  a  leader  faces  are  varying  shades  of  gray.  In  such 
circumstances,  competing  views  of  justice  vie  for  primacy  in  the  leader’s 
mind.  The  ancient  Jewish  King  Solomon’s  famous  judgment  between  two 
mothers  claiming  a  single  child  as  their  own  is  a  timeless  example  of  the 
real-world  wisdom  required  of  today’s  leaders.43  The  historical  account 
also  demonstrates  the  reward  of  true  justice,  noting  that,  “When  all  Israel 
heard  the  verdict  they  held  the  king  in  awe  because  they  saw  that  he  had 
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wisdom  from  God  to  administer  justice.”44  This  is  the  power  of  justice  in 
effecting  positive  cultural  change — a  3,000  year  old  lesson  relearned. 

How  do  we  practically  administer  such  justice?  Former  commander 
of  AFMC  Gen  Gregory  “Speedy”  Martin  provided  a  wise  framework  for 
such  decisions  during  a  personal  interview.  The  general  summed  up  his 
philosophy,  stating,  “You  need  to  look  at  a  problem  from  big  to  small 
while  ensuring  you  get  the  black  and  white  right.”45  “Big  to  small” 
requires  deference  to  the  long-term  implications  of  a  decision  as  opposed 
to  short-term,  local  effects.  “Black  and  white  right”  requires  a  leader  to 
check  the  facts  before  rendering  a  decision.  The  following  real-world 
example  is  illustrative  of  the  point. 

Jack  was  a  hard-working  employee  and  recognized  expert  in  his 
field  for  almost  10  years.  Jill  was  a  highly-motivated,  dedicated  employee 
with  just  over  a  year’s  experience.  In  a  meeting,  Jack’s  frustration  with 
Jill’s  performance  on  an  issue  boiled  over  in  a  series  of  expletives — 
unacceptable  behavior  in  a  professional  organization.  Jill  was  rightly 
offended  by  Jack’s  action  and  demanded  restitution.  Since  Jack  was  a 
subcontract  employee,  the  commander’s  decision  was  binary.  Legal 
counsel  informed  him  that  he  could  either  (1)  fire  Jack;  or  (2)  do  nothing. 
The  contract  afforded  no  other  options.  On  a  small  scale  he  was  justified 
with  either  course  of  action,  but  from  a  big-picture  perspective  that 
considered  organizational  culture  and  justice  neither  were  acceptable 
options.  Doing  nothing  would  send  the  workforce  a  message  that  Jack’s 
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expertise  was  valued  over  proper  workplace  relationships.  What  about 
firing?  The  facts  from  a  commander-directed  investigation  by  an 
individual  outside  the  organization  revealed  similar  incidents  dating  back 
across  the  10  years  of  Jack’s  employment.  Taking  time  to  understand  the 
black  and  white  revealed  prior  leadership’s  implicit  toleration  of  Jack’s 
behavior  as  no  disciplinary  action  or  documentation  existed  for  the 
previous  events.  To  fire  him  over  this  latest  incident  would  be 
hypocritical  as  leadership  failed  to  maintain  and  enforce  standards  over 
the  previous  10  years.  Of  the  two  sanctioned  options,  firing  Jack  was 
both  the  most  expedient  and  the  safest.  Unfortunately,  it  was  also 
unjust.  In  the  end  the  commander,  cognizant  of  the  big  picture,  risked 
his  own  position  for  justice  by  contacting  the  head  of  the  subcontractor’s 
company  directly.  He  worked  an  unsanctioned  arrangement  where  Jack 
publicly  apologized  to  Jill  and  also  attended  a  week  of  sensitivity 
training — a  punishment  that  fit  the  crime.  In  the  end,  workplace 
standards  of  conduct  were  clearly  articulated  and  enforced  and  future 
commanders  have  documented  evidence  of  the  event.  Most  importantly, 
Jill  and  the  rest  of  the  workplace  perceived  that  justice  was  served. 

Conclusion 

As  the  Air  Force  matures  as  a  service  we  must  choose  a  culture  for 
our  continued  long-term  success.  The  zero-defect  approach  practiced  by 
SAC  during  the  service’s  infancy  offers  short-term  success,  but  the 
resulting  culture  of  fear  and  reprisal  is  not  conducive  to  sustained 
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excellence.  Conversely,  the  tolerant  approach  of  QAF  adopted  during  our 
adolescence  provides  short-term  morale  benefits,  but  its  culture  of 
ambivalence  lacks  the  discipline  required  to  achieve  “Excellence  in  All  We 
Do.”  Ultimately,  long-term,  high  performance  is  possible  by  adopting  a 
fail-safe  approach  which  paradoxically  embraces  failure  through  a 
mindful  approach  to  building  a  resilient  enterprise.  This  fail-safe  culture 
occurs  when  leaders  clearly  articulate  the  boundaries  of  acceptable 
behavior  and  enforce  them  through  just  rewards  and  just  discipline.  It  is 
from  inside  the  security  of  these  clearly-defined  boundaries  that  our  fail¬ 
safe  culture  will  thrive. 
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